Is Tin: Save While Shopping safe?
Tin sends the full URL of every page you visit to its own servers while you are signed in.
The shopping extension runs on all sites, not only supported merchants. When you are signed in, it posts each page's full address, including query strings, with a session ID to its backend, and also sends a site-visit event to PostHog. Depending on feature flags, it also collects Open Graph and JSON-LD product metadata from the page.
Rated medium risk because of who publishes it: 2 of the 5 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: StayFocusd (high), Luna Adblock (high).
Who publishes itSensorTower Inc. - 5 other listings from the same operator, 5 of them carrying a finding
SensorTower Inc. - 5 other listings from the same operator, 5 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 100k+ users between them. 2 of them carry a finding.
Same operator - 3 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Tin: Save While Shopping contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- tin.st-panel-api.com
Tin: Save While Shopping sends data to tin.st-panel-api.com. No other extension we have analysed sends data here.
- PostHog
Tin: Save While Shopping sends data to PostHog. Named as a recipient by 1 other extensions we have analysed.